@@ -587,6 +587,53 @@ func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
587587 return rw.Code, rw.Body.String()
588588}
589589
590+type AlwaysSuccessfulValidator struct {
591+}
592+
593+func (AlwaysSuccessfulValidator) Validate(user, password string) bool {
594+ return true
595+}
596+
597+func TestManualSignInStoresUserGroupsInTheSession(t *testing.T) {
598+ userGroups := []string{"somegroup", "someothergroup"}
599+
600+ opts := baseTestOptions()
601+ opts.HtpasswdUserGroups = userGroups
602+ err := validation.Validate(opts)
603+ if err != nil {
604+ t.Fatal(err)
605+ }
606+
607+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
608+ return true
609+ })
610+ if err != nil {
611+ t.Fatal(err)
612+ }
613+ proxy.basicAuthValidator = AlwaysSuccessfulValidator{}
614+
615+ rw := httptest.NewRecorder()
616+ formData := url.Values{}
617+ formData.Set("username", "someuser")
618+ formData.Set("password", "somepass")
619+ signInReq, _ := http.NewRequest(http.MethodPost, "/oauth2/sign_in", strings.NewReader(formData.Encode()))
620+ signInReq.Header.Add("Content-Type", "application/x-www-form-urlencoded")
621+ proxy.ServeHTTP(rw, signInReq)
622+
623+ assert.Equal(t, http.StatusFound, rw.Code)
624+
625+ req, _ := http.NewRequest(http.MethodGet, "/something", strings.NewReader(formData.Encode()))
626+ for _, c := range rw.Result().Cookies() {
627+ req.AddCookie(c)
628+ }
629+
630+ s, err := proxy.sessionStore.Load(req)
631+ if err != nil {
632+ t.Fatal(err)
633+ }
634+ assert.Equal(t, userGroups, s.Groups)
635+}
636+
590637func TestSignInPageIncludesTargetRedirect(t *testing.T) {
591638 sipTest, err := NewSignInPageTest(false)
592639 if err != nil {